What can the Dropbox Dash Chrome extension see?

Quite a lot, by design. Dropbox's own help documentation says the Dash browser extension requires the broad permission to "read and change all your data on all websites," plus a separate permission to read your browsing history — and Dash's privacy documentation says it imports up to 90 days of that history to power its AI search.

Dropbox's Chrome-extension help article lists the permissions Dash needs and explains each one. On the first — "Read and change all your data on all websites" — Dropbox's own wording is: "This permission allows you to add any website you're visiting to an existing or new Stack. Dash needs to ask for this broad permission as it's not possible to only ask for read permissions. Rest assured that other than displaying a small pop-up in the top-right corner, Dash won't change data on your websites."

The extension also asks to "Read and change your browsing history on all your logged-in devices." Dropbox describes that one as powering search relevance: "This permission powers several Dash features to help you find what you're looking for, including improving and tailoring your search results to your browsing behavior. For example, if you've opened a file before, Dash will rank that file higher on your search results page." A note on the same page adds: "Dash will never change your browser history."

Separately from the extension's Chrome permission, Dropbox's own privacy documentation on Dash states that using the product imports your browser history going back roughly 90 days, including page contents — quoting Dropbox's language, "the contents of those websites (including page titles, images, and page content)" — and that this data may be shared with trusted third parties and other Dropbox companies to power search, according to this archive's earlier review of that documentation.

Dash's separate security page lists compliance and technical controls around the product — SOC 2 Type II, GDPR, and CCPA compliance, and encryption "using FIPS 140-2, Level 3 cryptographic services via AWS Key Management Service (KMS)" for content ingested from connected apps — but those controls apply to how Dash stores and protects the data it collects, not to whether the browser extension asks for the broad permission in the first place.

If you use Dash, you can at least limit the new-tab behavior: Dropbox's help article notes, "You can disable the default Dash tab by right-clicking (Dash) in your browser toolbar, then toggling Use Dash start page off." The broad host permission and the browsing-history import, however, are part of how the extension is designed to work, not settings you can narrow.